Backend API overview

The Backend API (BAPI) is the secret-key surface your servers call to manage everything in an instance: users, sessions, organizations, roles, OAuth clients, enterprise SSO, SCIM, webhooks, JWT templates, and instance configuration. It is the peer of the dashboard — everything a human can do in the console is also a REST call, so provisioning can be automated.

• Base URL: https://api.atlas.dev

• Auth: Authorization: Bearer sk_…

• Every route is under /v1/… and declares a scope (e.g. users:read). A key missing a route's scope gets 403 SCOPE_MISSING.

import { createAtlasClient } from '@atlas/backend';
const atlas = createAtlasClient({ secretKey: process.env.ATLAS_SECRET_KEY! });

Resource groups

For the complete machine-readable list of every BAPI route with its scope, see the Backend endpoint index.

Conventions recap

• Cursor pagination on list routes — limit + starting_after; response { data, has_more, next_cursor }.

• Idempotency on creates/mutations via the Idempotency-Key header (marked idempotent).

• Secrets shown once — client secrets, webhook signing secrets, API-key and SCIM-token secrets are revealed only at creation.

• Write-only secrets — provider client secrets, SAML IdP certs, captcha/kerberos secrets are stored encrypted and never read back; reads report a has_* marker instead.

• Cross-tenant is 404. An id from another instance is never 403.

Beyond the core

The BAPI also administers the whole instance: branding, email/SMS templates, localizations, OAuth providers (social sign-in config), messaging (BYOK email/SMS), Actions (auth-pipeline hooks), log streams, network ACLs, managed WAF, RADIUS clients, LTI platforms, attack protection, risk-based MFA, bot-signal export, data-subject (GDPR) requests, allow/block lists, waitlist, custom domains, billing plans, and instance security. Each of these appears with its endpoints and scope in the Backend endpoint index.